surf-cli 2.8.0 → 2.10.0

package/native/remote-auth.cjs

@@ -0,0 +1,279 @@
+const crypto = require("crypto");
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+
+const PROTOCOL_VERSION = 1;
+const NONCE_BYTES = 32;
+const LABEL_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+const CLIENT_ID_PATTERN = /^[a-f0-9]{32}$/;
+const STATE_DIR_MODE = 0o700;
+const STATE_FILE_MODE = 0o600;
+const DEFAULT_STATE_DIR = path.join(os.homedir(), ".surf", "remote");
+const HOST_IDENTITY_FILE = "host-identity.json";
+const CLIENT_REGISTRY_FILE = "remote-clients.json";
+const AUTH_DOMAIN = "surf-cli-remote-auth-v1";
+
+function getStateDir(env = process.env) {
+  return env.SURF_REMOTE_STATE_DIR || DEFAULT_STATE_DIR;
+}
+
+function assertSafeLabel(label) {
+  if (typeof label !== "string" || !LABEL_PATTERN.test(label)) {
+    throw new Error("remote client label must be 1-64 characters using letters, numbers, dot, underscore, or hyphen");
+  }
+  return label;
+}
+
+function assertClientId(clientId) {
+  if (typeof clientId !== "string" || !CLIENT_ID_PATTERN.test(clientId)) throw new Error("remote client ID is invalid");
+}
+
+function statePaths(stateDir = getStateDir()) {
+  return {
+    stateDir,
+    hostIdentity: path.join(stateDir, HOST_IDENTITY_FILE),
+    registry: path.join(stateDir, CLIENT_REGISTRY_FILE),
+  };
+}
+
+function assertNotSymlink(filePath, allowMissing = true) {
+  try {
+    const stat = fs.lstatSync(filePath);
+    if (stat.isSymbolicLink()) throw new Error(`refusing symbolic link: ${filePath}`);
+    return stat;
+  } catch (error) {
+    if (allowMissing && error?.code === "ENOENT") return null;
+    throw error;
+  }
+}
+
+function ensureStateDir(stateDir) {
+  assertNotSymlink(stateDir, true);
+  fs.mkdirSync(stateDir, { recursive: true, mode: STATE_DIR_MODE });
+  const stat = assertNotSymlink(stateDir, false);
+  if (!stat.isDirectory()) throw new Error(`remote state path is not a directory: ${stateDir}`);
+  fs.chmodSync(stateDir, STATE_DIR_MODE);
+}
+
+function assertPrivateFile(filePath) {
+  const stat = assertNotSymlink(filePath, false);
+  if (!stat.isFile()) throw new Error(`remote state path is not a file: ${filePath}`);
+  if ((stat.mode & 0o077) !== 0) throw new Error(`remote state file permissions are too broad: ${filePath}`);
+  return stat;
+}
+
+function atomicWriteJson(filePath, value) {
+  const dir = path.dirname(filePath);
+  assertNotSymlink(dir, true);
+  fs.mkdirSync(dir, { recursive: true, mode: STATE_DIR_MODE });
+  assertNotSymlink(dir, false);
+  assertNotSymlink(filePath, true);
+  const tempPath = path.join(dir, `.${path.basename(filePath)}.${process.pid}.${crypto.randomBytes(8).toString("hex")}.tmp`);
+  let created = false;
+  try {
+    const fd = fs.openSync(tempPath, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL, STATE_FILE_MODE);
+    created = true;
+    try {
+      fs.writeFileSync(fd, `${JSON.stringify(value, null, 2)}\n`, "utf8");
+      fs.fsyncSync(fd);
+    } finally {
+      fs.closeSync(fd);
+    }
+    fs.renameSync(tempPath, filePath);
+    fs.chmodSync(filePath, STATE_FILE_MODE);
+  } finally {
+    if (created) {
+      try { fs.unlinkSync(tempPath); } catch {}
+    }
+  }
+}
+
+function readJson(filePath, fallback) {
+  const stat = assertNotSymlink(filePath, true);
+  if (!stat) return fallback;
+  assertPrivateFile(filePath);
+  const value = JSON.parse(fs.readFileSync(filePath, "utf8"));
+  return value;
+}
+
+function exportKey(keyObject, type) {
+  return keyObject.export({ type, format: "der" }).toString("base64");
+}
+
+function importPublicKey(value) {
+  if (typeof value !== "string" || !value) throw new Error("remote public key is missing");
+  return crypto.createPublicKey({ key: Buffer.from(value, "base64"), type: "spki", format: "der" });
+}
+
+function importPrivateKey(value) {
+  if (typeof value !== "string" || !value) throw new Error("remote private key is missing");
+  return crypto.createPrivateKey({ key: Buffer.from(value, "base64"), type: "pkcs8", format: "der" });
+}
+
+function loadHostIdentity(stateDir = getStateDir()) {
+  const { hostIdentity } = statePaths(stateDir);
+  const value = readJson(hostIdentity, null);
+  if (!value || value.version !== 1 || typeof value.publicKey !== "string" || typeof value.privateKey !== "string") {
+    throw new Error("remote host identity is invalid");
+  }
+  const privateKey = importPrivateKey(value.privateKey);
+  const publicKey = importPublicKey(value.publicKey);
+  return { stateDir, path: hostIdentity, publicKey: value.publicKey, privateKey, publicKeyObject: publicKey };
+}
+
+function ensureHostIdentity(stateDir = getStateDir()) {
+  ensureStateDir(stateDir);
+  const { hostIdentity } = statePaths(stateDir);
+  const existing = readJson(hostIdentity, null);
+  if (existing) return loadHostIdentity(stateDir);
+  const pair = crypto.generateKeyPairSync("ed25519");
+  const value = { version: 1, publicKey: exportKey(pair.publicKey, "spki"), privateKey: exportKey(pair.privateKey, "pkcs8"), createdAt: new Date().toISOString() };
+  atomicWriteJson(hostIdentity, value);
+  return loadHostIdentity(stateDir);
+}
+
+function loadRegistry(stateDir = getStateDir()) {
+  ensureStateDir(stateDir);
+  const { registry } = statePaths(stateDir);
+  const value = readJson(registry, null);
+  if (!value) return { version: 1, clients: [] };
+  if (value.version !== 1 || !Array.isArray(value.clients)) throw new Error("remote client registry is invalid");
+  for (const client of value.clients) {
+    assertClientId(client.id);
+    assertSafeLabel(client.label);
+    importPublicKey(client.publicKey);
+  }
+  return value;
+}
+
+function saveRegistry(stateDir, registry) {
+  const { registry: registryPath } = statePaths(stateDir);
+  atomicWriteJson(registryPath, registry);
+}
+
+function authorizeClient(label, outputPath, stateDir = getStateDir()) {
+  assertSafeLabel(label);
+  if (typeof outputPath !== "string" || !outputPath) throw new Error("--output is required for remote authorize");
+  ensureStateDir(stateDir);
+  const host = ensureHostIdentity(stateDir);
+  const registry = loadRegistry(stateDir);
+  if (registry.clients.some((client) => client.label === label)) throw new Error(`remote client label already exists: ${label}`);
+  const output = path.resolve(outputPath);
+  assertNotSymlink(output, true);
+  if (fs.existsSync(output)) throw new Error(`credential output already exists: ${output}`);
+  const pair = crypto.generateKeyPairSync("ed25519");
+  const client = {
+    id: crypto.randomBytes(16).toString("hex"),
+    label,
+    publicKey: exportKey(pair.publicKey, "spki"),
+    createdAt: new Date().toISOString(),
+  };
+  const credential = {
+    version: 1,
+    clientId: client.id,
+    label,
+    privateKey: exportKey(pair.privateKey, "pkcs8"),
+    publicKey: client.publicKey,
+    hostPublicKey: host.publicKey,
+  };
+  registry.clients.push(client);
+  saveRegistry(stateDir, registry);
+  try {
+    atomicWriteJson(output, credential);
+  } catch (error) {
+    registry.clients = registry.clients.filter((entry) => entry.id !== client.id);
+    saveRegistry(stateDir, registry);
+    throw error;
+  }
+  return { ...client, output, hostPublicKey: host.publicKey };
+}
+
+function listClients(stateDir = getStateDir()) {
+  return loadRegistry(stateDir).clients.map(({ id, label, createdAt }) => ({ id, label, createdAt }));
+}
+
+function revokeClient(label, stateDir = getStateDir()) {
+  assertSafeLabel(label);
+  const registry = loadRegistry(stateDir);
+  const before = registry.clients.length;
+  registry.clients = registry.clients.filter((client) => client.label !== label);
+  if (registry.clients.length === before) throw new Error(`remote client not found: ${label}`);
+  saveRegistry(stateDir, registry);
+  return { label };
+}
+
+function loadCredential(credentialPath) {
+  if (typeof credentialPath !== "string" || !credentialPath) throw new Error("remote credential path is required");
+  const resolved = path.resolve(credentialPath);
+  assertPrivateFile(resolved);
+  const value = JSON.parse(fs.readFileSync(resolved, "utf8"));
+  if (value.version !== 1 || typeof value.clientId !== "string" || typeof value.label !== "string" || typeof value.publicKey !== "string" || typeof value.hostPublicKey !== "string") {
+    throw new Error("remote credential is invalid");
+  }
+  assertClientId(value.clientId);
+  assertSafeLabel(value.label);
+  const privateKey = importPrivateKey(value.privateKey);
+  const publicKey = importPublicKey(value.publicKey);
+  importPublicKey(value.hostPublicKey);
+  return { ...value, path: resolved, privateKey, publicKeyObject: publicKey };
+}
+
+function canonicalTranscript(role, clientId, clientNonce, serverNonce, clientPublicKey, hostPublicKey) {
+  assertClientId(clientId);
+  for (const [name, value] of [["clientNonce", clientNonce], ["serverNonce", serverNonce], ["clientPublicKey", clientPublicKey], ["hostPublicKey", hostPublicKey]]) {
+    if (typeof value !== "string" || !/^[A-Za-z0-9+/]+={0,2}$/.test(value)) throw new Error(`${name} is invalid`);
+  }
+  if (role !== "server" && role !== "client") throw new Error("authentication role is invalid");
+  return Buffer.from([AUTH_DOMAIN, String(PROTOCOL_VERSION), role, clientId, clientNonce, serverNonce, clientPublicKey, hostPublicKey].join("\0"), "utf8");
+}
+
+function verifySignature(publicKey, data, signature) {
+  return crypto.verify(null, data, publicKey, Buffer.from(signature, "base64"));
+}
+
+function signChallenge(host, clientId, clientNonce, serverNonce, clientPublicKey) {
+  const data = canonicalTranscript("server", clientId, clientNonce, serverNonce, clientPublicKey, host.publicKey);
+  return crypto.sign(null, data, host.privateKey).toString("base64");
+}
+
+function signProof(credential, clientNonce, serverNonce) {
+  const data = canonicalTranscript("client", credential.clientId, clientNonce, serverNonce, credential.publicKey, credential.hostPublicKey);
+  return crypto.sign(null, data, credential.privateKey).toString("base64");
+}
+
+function verifyChallenge(credential, challenge) {
+  if (challenge.version !== PROTOCOL_VERSION || challenge.clientId !== credential.clientId || challenge.hostPublicKey !== credential.hostPublicKey) return false;
+  const data = canonicalTranscript("server", credential.clientId, challenge.clientNonce, challenge.serverNonce, credential.publicKey, credential.hostPublicKey);
+  return verifySignature(importPublicKey(credential.hostPublicKey), data, challenge.signature);
+}
+
+function verifyProof(client, hostPublicKey, clientNonce, serverNonce, proof) {
+  const data = canonicalTranscript("client", client.id, clientNonce, serverNonce, client.publicKey, hostPublicKey);
+  return verifySignature(importPublicKey(client.publicKey), data, proof);
+}
+
+module.exports = {
+  AUTH_DOMAIN,
+  CLIENT_ID_PATTERN,
+  LABEL_PATTERN,
+  NONCE_BYTES,
+  PROTOCOL_VERSION,
+  STATE_DIR_MODE,
+  STATE_FILE_MODE,
+  authorizeClient,
+  canonicalTranscript,
+  ensureHostIdentity,
+  getStateDir,
+  listClients,
+  loadCredential,
+  loadHostIdentity,
+  loadRegistry,
+  revokeClient,
+  signChallenge,
+  signProof,
+  statePaths,
+  verifyChallenge,
+  verifyProof,
+  importPublicKey,
+};

package/native/remote-transport.cjs

@@ -0,0 +1,337 @@
+const net = require("net");
+const crypto = require("crypto");
+const { loadCredential, loadHostIdentity, loadRegistry, NONCE_BYTES, PROTOCOL_VERSION, signProof, signChallenge, verifyChallenge, verifyProof } = require("./remote-auth.cjs");
+
+const MAX_FRAME_BYTES = 1024 * 1024;
+const DEFAULT_FRAME_TIMEOUT_MS = 10000;
+const DEFAULT_AUTH_TIMEOUT_MS = 5000;
+
+function writeFrame(socket, value) {
+  const encoded = Buffer.from(`${JSON.stringify(value)}\n`, "utf8");
+  if (encoded.length - 1 > MAX_FRAME_BYTES) return Promise.reject(new Error("frame exceeds byte limit"));
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    let drainListener;
+    const cleanup = () => {
+      socket.removeListener("error", fail);
+      socket.removeListener("close", close);
+      if (drainListener) socket.removeListener("drain", drainListener);
+    };
+    const fail = (error) => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      reject(error);
+    };
+    const done = () => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      resolve();
+    };
+    const close = () => fail(new Error("socket closed while writing frame"));
+    socket.once("error", fail);
+    socket.once("close", close);
+    if (socket.write(encoded)) {
+      done();
+    } else {
+      drainListener = done;
+      socket.once("drain", drainListener);
+    }
+  });
+}
+
+function createSocketWriter(socket, { maxPendingBytes = 4 * 1024 * 1024, onOverflow = () => {} } = {}) {
+  const queue = [];
+  let pendingBytes = 0;
+  let writing = false;
+  let current;
+  let currentErrorListener;
+  let closed = false;
+  let drainListener;
+  const failQueue = (error) => {
+    while (queue.length) queue.shift().reject(error);
+    pendingBytes = 0;
+  };
+  const close = (error = new Error("socket writer closed")) => {
+    if (closed) return;
+    closed = true;
+    if (drainListener) socket.removeListener("drain", drainListener);
+    if (current) {
+      const item = current;
+      current = undefined;
+      writing = false;
+      if (currentErrorListener) socket.removeListener("error", currentErrorListener);
+      currentErrorListener = undefined;
+      item.reject(error);
+    }
+    failQueue(error);
+  };
+  const pump = () => {
+    if (writing || closed || queue.length === 0) return;
+    writing = true;
+    const item = queue.shift();
+    current = item;
+    const finish = (error) => {
+      if (!writing) return;
+      writing = false;
+      current = undefined;
+      pendingBytes -= item.bytes;
+      socket.removeListener("error", finish);
+      if (currentErrorListener === finish) currentErrorListener = undefined;
+      if (drainListener) {
+        socket.removeListener("drain", drainListener);
+        drainListener = undefined;
+      }
+      if (error) item.reject(error);
+      else item.resolve();
+      pump();
+    };
+    currentErrorListener = finish;
+    socket.once("error", finish);
+    try {
+      if (socket.write(item.encoded)) {
+        socket.removeListener("error", finish);
+        finish();
+      } else {
+        drainListener = () => {
+          drainListener = undefined;
+          socket.removeListener("error", finish);
+          finish();
+        };
+        socket.once("drain", drainListener);
+      }
+    } catch (error) {
+      socket.removeListener("error", finish);
+      finish(error);
+    }
+  };
+  const send = (value, { stream = false } = {}) => {
+    if (closed) return Promise.reject(new Error("socket writer is closed"));
+    const encoded = Buffer.from(`${JSON.stringify(value)}\n`, "utf8");
+    if (encoded.length - 1 > MAX_FRAME_BYTES) return Promise.reject(new Error("frame exceeds byte limit"));
+    if (pendingBytes + encoded.length > maxPendingBytes) {
+      const error = new Error("socket writer queue is full");
+      onOverflow({ stream, error });
+      return Promise.reject(error);
+    }
+    return new Promise((resolve, reject) => {
+      queue.push({ encoded, bytes: encoded.length, resolve, reject });
+      pendingBytes += encoded.length;
+      pump();
+    });
+  };
+  return { send, close, get pendingBytes() { return pendingBytes; } };
+}
+
+function createFrameParser({ onFrame, onError, maxFrameBytes = MAX_FRAME_BYTES, frameTimeoutMs = DEFAULT_FRAME_TIMEOUT_MS }) {
+  let buffer = Buffer.alloc(0);
+  let timer = null;
+  let closed = false;
+  const fail = (error) => {
+    if (closed) return;
+    closed = true;
+    if (timer) clearTimeout(timer);
+    onError(error);
+  };
+  const armDeadline = () => {
+    if (timer || buffer.length === 0) return;
+    timer = setTimeout(() => fail(new Error("incomplete frame timed out")), frameTimeoutMs);
+  };
+  const clearDeadline = () => {
+    if (buffer.length === 0 && timer) {
+      clearTimeout(timer);
+      timer = null;
+    }
+  };
+  return {
+    push(chunk) {
+      if (closed) return;
+      buffer = Buffer.concat([buffer, chunk]);
+      if (buffer.length > maxFrameBytes + 1 && buffer.indexOf(0x0a) === -1) {
+        fail(new Error("frame exceeds byte limit"));
+        return;
+      }
+      let newline;
+      while ((newline = buffer.indexOf(0x0a)) !== -1) {
+        const frame = buffer.subarray(0, newline);
+        buffer = buffer.subarray(newline + 1);
+        if (frame.length > maxFrameBytes) {
+          fail(new Error("frame exceeds byte limit"));
+          return;
+        }
+        if (frame.length === 0) continue;
+        let line;
+        try {
+          line = new TextDecoder("utf-8", { fatal: true }).decode(frame);
+        } catch {
+          fail(new Error("frame contains invalid UTF-8"));
+          return;
+        }
+        let value;
+        try {
+          value = JSON.parse(line);
+        } catch {
+          fail(new Error("frame contains invalid JSON"));
+          return;
+        }
+        onFrame(value);
+        if (closed) return;
+      }
+      if (buffer.length > maxFrameBytes) {
+        fail(new Error("frame exceeds byte limit"));
+        return;
+      }
+      clearDeadline();
+      armDeadline();
+    },
+    close() {
+      closed = true;
+      if (timer) clearTimeout(timer);
+      timer = null;
+      buffer = Buffer.alloc(0);
+    },
+  };
+}
+
+function waitForFrame(socket, timeoutMs = DEFAULT_AUTH_TIMEOUT_MS) {
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const parser = createFrameParser({
+      onFrame(value) {
+        if (settled) return;
+        settled = true;
+        cleanup();
+        resolve(value);
+      },
+      onError(error) {
+        if (settled) return;
+        settled = true;
+        cleanup();
+        reject(error);
+      },
+      frameTimeoutMs: timeoutMs,
+    });
+    const timer = setTimeout(() => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      reject(new Error("authentication timed out"));
+    }, timeoutMs);
+    const onData = (chunk) => parser.push(chunk);
+    const onError = (error) => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      reject(error);
+    };
+    const onClose = () => onError(new Error("connection closed during authentication"));
+    const cleanup = () => {
+      clearTimeout(timer);
+      parser.close();
+      socket.removeListener("data", onData);
+      socket.removeListener("error", onError);
+      socket.removeListener("close", onClose);
+    };
+    socket.on("data", onData);
+    socket.once("error", onError);
+    socket.once("close", onClose);
+  });
+}
+
+async function authenticateClient(socket, credentialPathOrValue, options = {}) {
+  const credential = typeof credentialPathOrValue === "string" ? loadCredential(credentialPathOrValue) : credentialPathOrValue;
+  const timeoutMs = options.timeoutMs ?? DEFAULT_AUTH_TIMEOUT_MS;
+  const clientNonce = crypto.randomBytes(NONCE_BYTES).toString("base64");
+  await writeFrame(socket, { type: "auth_hello", version: PROTOCOL_VERSION, clientId: credential.clientId, clientNonce });
+  const challenge = await waitForFrame(socket, timeoutMs);
+  if (challenge.type === "auth_error") throw new Error(challenge.message || "remote authentication rejected");
+  if (challenge.type !== "auth_challenge") throw new Error("remote authentication protocol error");
+  if (!verifyChallenge(credential, challenge)) throw new Error("remote server identity verification failed");
+  const proof = signProof(credential, clientNonce, challenge.serverNonce);
+  await writeFrame(socket, { type: "auth_proof", version: PROTOCOL_VERSION, clientId: credential.clientId, proof });
+  const result = await waitForFrame(socket, timeoutMs);
+  if (result.type !== "auth_ok" || result.clientId !== credential.clientId) throw new Error(result.message || "remote authentication failed");
+  return { clientId: credential.clientId, label: credential.label };
+}
+
+function createServerAuthSession({ socket, stateDir, send = (value) => writeFrame(socket, value), timeoutMs = DEFAULT_AUTH_TIMEOUT_MS, onAuthenticated, onError }) {
+  let state = "pending";
+  let timer = setTimeout(() => fail(new Error("authentication timed out")), timeoutMs);
+  let clientNonce;
+  let serverNonce;
+  let client;
+  let host;
+  const fail = (error) => {
+    if (state === "authenticated" || state === "failed") return;
+    state = "failed";
+    clearTimeout(timer);
+    onError(error);
+  };
+  const handle = async (message) => {
+    if (state !== "pending") return false;
+    try {
+      if (message.type !== "auth_hello") throw new Error("authentication required before requests");
+      if (message.version !== PROTOCOL_VERSION || typeof message.clientNonce !== "string" || Buffer.from(message.clientNonce, "base64").length !== NONCE_BYTES) throw new Error("invalid authentication hello");
+      const registry = loadRegistry(stateDir);
+      client = registry.clients.find((entry) => entry.id === message.clientId);
+      if (!client) throw new Error("remote client is not authorized");
+      host = loadHostIdentity(stateDir);
+      clientNonce = message.clientNonce;
+      serverNonce = crypto.randomBytes(NONCE_BYTES).toString("base64");
+      const signature = signChallenge(host, client.id, clientNonce, serverNonce, client.publicKey);
+      await send({ type: "auth_challenge", version: PROTOCOL_VERSION, clientId: client.id, clientNonce, serverNonce, hostPublicKey: host.publicKey, signature });
+      state = "proof";
+      return true;
+    } catch (error) {
+      fail(error);
+      return false;
+    }
+  };
+  const handleProof = async (message) => {
+    if (state !== "proof") return false;
+    try {
+      if (message.type !== "auth_proof" || message.version !== PROTOCOL_VERSION || message.clientId !== client.id || typeof message.proof !== "string") throw new Error("invalid authentication proof");
+      if (!verifyProof(client, host.publicKey, clientNonce, serverNonce, message.proof)) throw new Error("remote client proof verification failed");
+      await onAuthenticated({ clientId: client.id, label: client.label });
+      state = "authenticated";
+      clearTimeout(timer);
+      await send({ type: "auth_ok", version: PROTOCOL_VERSION, clientId: client.id, label: client.label });
+      return true;
+    } catch (error) {
+      fail(error);
+      return false;
+    }
+  };
+  return {
+    get authenticated() { return state === "authenticated"; },
+    get failed() { return state === "failed"; },
+    get principal() { return state === "authenticated" ? { clientId: client.id, label: client.label } : null; },
+    handle(message) {
+      if (state === "pending") return handle(message);
+      if (state === "proof") return handleProof(message);
+      return Promise.resolve(false);
+    },
+    close() {
+      clearTimeout(timer);
+      if (state !== "authenticated") state = "failed";
+    },
+  };
+}
+
+function isClientAuthorized(stateDir, clientId) {
+  return loadRegistry(stateDir).clients.some((entry) => entry.id === clientId);
+}
+
+module.exports = {
+  DEFAULT_AUTH_TIMEOUT_MS,
+  DEFAULT_FRAME_TIMEOUT_MS,
+  MAX_FRAME_BYTES,
+  createSocketWriter,
+  authenticateClient,
+  createFrameParser,
+  createServerAuthSession,
+  isClientAuthorized,
+  waitForFrame,
+  writeFrame,
+};